InfoSecBulletin Cybersecurity for mankind
GitLab has issued a warning about a serious vulnerability in its GitLab Community and Enterprise editions. This vulnerability allows attackers to execute pipeline jobs as if they were another user.
GitLab’s DevSecOps platform is used by more than 30 million registered users, including T-Mobile, Goldman Sachs, Airbus, Lockheed Martin, Nvidia, and UBS. It is also preferred by over 50% of Fortune 100 companies.
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
The security update fixed a flaw identified as CVE-2024-6385 with a severity rating of 9.6 out of 10.
ViperSoftX malware secretly uses AutoIT scripting to run PowerShell. It affects GitLab CE/EE versions from 15.8 to 16.11.6, 17.0 to 17.0.4, and 17.1 to 17.1.2. Attackers can exploit this to start a new pipeline as a different user, under specific conditions which GitLab has not yet revealed.
GitLab pipelines are a feature of a system called Continuous Integration/Continuous Deployment (CI/CD). They allow users to run processes and tasks automatically, either at the same time or one after the other, in order to build, test, or deploy changes to the code.
Company released GitLab Community and Enterprise versions 17.1.2, 17.0.4, and 16.11.6 to fix security flaw. Admins are advised to upgrade all installations right away.
“We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” it warned. “GitLab.com and GitLab Dedicated are already running the patched version.”
